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DETAILED ACTION 

1 . A response was received on 01 November 2005. No claims have been 
amended, added, or canceled. Claims 1-23 are currently pending in the present 
application. 

Response to Arguments 

2. Applicant's arguments filed 01 November 2005 have been fully considered but 
they are not persuasive. 

Claim 2 was rejected under 35 U.S.C. 103(a) as unpatentable over Cohen et al, 
US Patent 617851 1 , in view of Levergood et al, US Patent 5708780. Claims 1 and 3-23 
were rejected under 35 U.S.C. 103(a) as unpatentable over Cohen in view of Levergood 
and de la Huerga et al, US Patent 5903889. 

Regarding Applicant's arguments as a whole, in response to applicant's 
arguments against the references individually, one cannot show nonobviousness by 
attacking references individually where the rejections are based on combinations of 
references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981 ); In re Merck & 
Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). 

Specifically, in reference to independent Claims 1,6, 14, 21, and 23, Applicant 
argues that Levergood does not disclose "automatically communicating application 
specific context information... in response to authentication of said user identification 



Application/Control Number: 09/817,324 Page 3 

Art Unit: 2137 

information", nor does de la Huerga. The Examiner respectfully disagrees. The 
Examiner believes that Levergood does disclose communicating the application specific 
context information "in response to authentication" (see column 6, lines 58-66, and 
column 7, lines 15-21 , where after authentication of the user, a URL with an SID 
including user identification, i.e. context information, is automatically forwarded). 

Applicant further argues that de la Huerga does not even contemplate a 
"session" and therefore cannot disclose a session identifier. However, the Examiner 
first notes that de la Huerga was not relied upon for the explicit disclosure of a session 
identifier, and that Levergood was instead relied upon for disclosure of this feature. De 
la Huerga was instead relied upon for the general teaching of placing the context 
information (e.g. patient identifier) in a separate data field from other information. 
Because the references are in a similar area of endeavor (noting that both Levergood 
and de la Huerga, both send context information in fields of URLs), it is reasonable to 
combine their teachings. The Examiner therefore believes that the combination of 
Levergood and de la Huerga would suggest to one of ordinary skill in the art to send 
context information and session information in separate fields of a URL. 

Applicant additionally argues that session identification information is not 
application specific context information and therefore does not support acquisition from 
the second application of information associated with a current operational context of 
the first application (see page 15 of the present response). However, the Examiner 
notes that Applicant's specification defines context information to include a session 
identifier (page 5, lines 28-29 of the present specification). Further, the Examiner 
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believes that Levergood does disclose acquiring information associated with a current 
operational context (where a page is forwarded based on the session identifier received; 
see, for example, column 6, lines 22-24). 

In response to applicant's argument that "incorporating the de la Huerga features 
in Cohen with Levergood ... results in the system burden of requiring a user to initiate at 
least a second command" (see page 15 of the present response), the Examiner first 
notes that the result of such a combination is mere speculation on the part of Applicant. 
Further, the Examiner reminds Applicant that the test for obviousness is not whether the 
features of a secondary reference may be bodily incorporated into the structure of the 
primary reference; nor is it that the claimed invention must be expressly suggested in 
any one or all of the references. Rather, the test is what the combined teachings of the 
references would have suggested to those of ordinary skill in the art. See In re Keller, 
642 F.2d 413, 208 USPQ 871 (CCPA 1981). 

In response to applicant's argument that there is no suggestion to combine the 
references, the examiner recognizes that obviousness can only be established by 
combining or modifying the teachings of the prior art to produce the claimed invention 
where there is some teaching, suggestion, or motivation to do so found either in the 
references themselves or in the knowledge generally available to one of ordinary skill in 
the art. See In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988) and In re 
Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992). In this case, the motivation to 
combine Cohen and Levergood is to allow access to all controlled files within a specific 
domain without requiring additional authorization beyond the initial authorization as 
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suggested by Levergood (column 3, lines 50-55) and cited in the previous actions. The 
motivation to further incorporate de la Huerga was also cited in the previous action, 
namely, to allow for economical and easy access to information, particularly medical 
records, stored in various distributed databases (see de la Huerga, column 2, lines 40- 
62). 

Therefore, for the reasons of motivation cited above, the Examiner maintains that 
it would be obvious to one of ordinary skill in the art to combine the various teachings of 
Cohen (notably the single sign-on through an authentication service), Levergood 
(notably automatically communicating session. identification and user identification data 
in a data field of a URL), and de la Huerga (notably communicating context information 
and other data in separate fields). 

Regarding dependent Claim 4, Applicant again argues that the references do not 
teach or suggest dynamic compilation of a database including authentication service 
identifier and user identifier data pairs. The Examiner notes that this argument was 
addressed in the previous Action, which comments Applicant has not attempted to 
rebut. Specifically, the Examiner first notes that the claim does not recite that the 
database is compiled dynamically, merely that a database is compiled. That distinction 
notwithstanding, the Examiner believes that the cited portions of Cohen do, in fact, 
suggest that the database can be modified dynamically (see column 5, lines 5-6, where 
passwords in the database are managed, i.e. they can be changed and are therefore 
dynamic; see also column 5, lines 45-58 where the logon targets can be created, 
updated, and deleted). Further, the Examiner believes that the cited portion of Cohen 
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does disclose both a user identifier (column 4, lines 64-67, where a username and 
passwords are stored in the database) and an authentication service identifier (column 
5, lines 1-2, where domain, host, and application names are stored; also column 5, lines 
45-58 where logon targets are defined in the database). Similarly regarding dependent 
Claim 7, the Examiner believes that Cohen does disclose an authentication service 
identifier (see above). 

Regarding dependent Claim 8, Applicant's arguments fail to comply with 37 
CFR 1 .1 1 1(b) because they amount to a general allegation that the claims define a 
patentable invention without specifically pointing out how the language of the claims 
patentably distinguishes them from the references. 

Regarding dependent Claim 1 1 , Applicant again argues that the references do 
not teach or suggest communicating a parameter indicating success or failure. The 
Examiner notes that this argument was addressed in the previous Action, which 
comments Applicant has not attempted to rebut. Specifically, the Examiner notes that 
the cited portion does indeed disclose a parameter indicating success or failure (the 
return codes of column 10, lines 35-37, noting that the immediately preceding section 
further describes a single sign-on where a username and password are presented to 
logon to a domain); the Examiner additionally notes that it would be obvious to provide 
such a parameter for any action where it is of use to know whether the action 
succeeded. 

Regarding independent Claim 2, again, in response to applicant's arguments 
against the references individually, one cannot show nonobviousness by attacking 
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references individually where the rejections are based on combinations of references. 
See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 
F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). Specifically, Applicant argues that 
Levergood does not disclose encrypting an address portion and that the "domain" of 
Levergood is not an address. The Examiner does not dispute Applicant's assertion that 
Levergood distinguishes between the URL in which the encrypted identifier is included 
and the IP address of the user computer. However, the Examiner disagrees with 
Applicant's characterization of the domain. The Examiner notes that Applicant again 
states that the domain is defined as a "collection of controlled files of common 
protection within one or more servers". The Examiner again asserts that if the domain 
includes a collection of files within a server, then the domain must include at least some 
identification and/or, as a logical form of identification, addresses for these files. 
Therefore, the Examiner believes that it is, at the very least, implicitly suggested that the 
domain can include an address portion of a URL. The Examiner notes that Levergood 
discloses that as part of the validation process, it is determined whether the destination 
page of the entered matches the domain encrypted in the SID in the URL (see column 
5, line 66-column 6, line 16). The Examiner believes that this further suggests that the 
domain includes an address of a URL. 

Further, in response to applicant's argument that Levergood has a different 
purpose than the present application (see page 25 of the present response), the fact 
that applicant has recognized another advantage which would flow naturally from 
following the suggestion of the prior art cannot be the basis for patentability when the 
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differences would otherwise be obvious. See Ex parte Obiaya, 227 USPQ 58, 60 (Bd. 
Pat. App. & Inter. 1 985). Further, it is unclear to the Examiner why Applicant argues 
against "amending the Levergood system to include the claimed arrangement" when the 
teachings of the Levergood system are being used to modify the Cohen system, and not 
vice versa. 

Therefore, for the reasons detailed above, the Examiner maintains the rejections 
set forth below. 

Claim Rejections - 35 USC §112 

3. The rejection of Claims 1 and 3-23 under 35 U.S.C. 112, first paragraph, is 
withdrawn in light of the clarifications presented in the present response (pages 9-10 of 
the present response). 

4. The Examiner further notes that the objection to the specification under 37 CFR 
1.75(d)(1) is withdrawn for similar reasons. 

Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention Is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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6. Claim 2 is rejected under 35 U.S.C. 103(a) as being unpatentable over Cohen et 
al, US Patent 617851 1 , in view of Levergood et al, US Patent 5708780. 

Cohen discloses a system used by a first application including an authentication 
processor (Figure 2, Authentication Module 21 ) that receives user identification 
information and initiates authentication of the user identification information using an 
authentication service (column 6, lines 8-18) and a communication processor that 
communicates an authentication service identifier and a corresponding user identifier to 
a managing application (column 6, lines 26-37). Cohen further discloses the use of a 
user identifier (column 4, line 64-column 5, line 2). However, Cohen does not explicitly 
disclose automatically communicating context information in a data field of a URL to a 
second application in response a user command to initiate execution of the second 
application, nor does Cohen explicitly disclose encrypting a URL address portion. 

Levergood discloses a system that includes an authentication processor (column 
6, lines 36-42) and that, when a user requests execution of a second application, 
automatically communicates specific context information in a data field of a URL to the 
second application (see column 4, lines 1-18). Further, Levergood discloses that the 
specific context information is a user identifier (column 5, lines 56-61) and that a URL 
address portion is encrypted and incorporated into the URL (column 5, lines 61-65; 
column 3, lines 34-37, noting that the SID includes a domain that is included under the 
digital signature). Therefore, it would have been obvious to one of ordinary skill in the 
art at the time the invention was made to modify the system of Cohen by including the 
automatic communication described by Levergood, in order to allow access to all 
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controlled files within a specific domain without requiring additional authorization beyond 
the initial authorization (see Levergood, column 3, lines 50-55). 

7. Claims 1 and 3-23 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Cohen in view of Levergood and de la Huerga et al, US Patent 5903889. 

In reference to Claim 1 , Cohen discloses a system used by a first application 
including an authentication processor (Figure 2, Authentication Module 21) that receives 
user identification information and initiates authentication of the user identification 
information using an authentication service (column 6, lines 8-18) and a communication 
processor that communicates an authentication service identifier and a corresponding 
user identifier to a managing application (column 6, lines 26-37). However, Cohen does 
not explicitly disclose automatically communicating context information in a data field of 
a URL to a second application in response a user command to initiate execution of the 
second application. 

Levergood discloses a system that includes an authentication processor (column 
6, lines 36-42) and that, when a user requests execution of a second application, 
automatically communicates specific context information in a data field of a URL to the 
second application (see column 4, lines 1-18) in response to authentication of user 
identification information (see column 6, lines 58-66, and column 7, lines 15-21) where 
the context information supports acquisition of information associated with a current 
context (see column 6, lines 22-24), Therefore, it would have been obvious to one of 
ordinary skill in the art at the time the invention was made to modify the system of 
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Cohen by including the automatic communication described by Levergood, in order to 
allow access to all controlled files within a specific domain without requiring additional 
authorization beyond the initial authorization (see Levergood, column 3, lines 50-55). 
However, although Levergood discloses a session identifier (column 3, lines 12-16), 
neither Levergood nor Cohen explicitly discloses that the application specific context 
information is communicated separately from a session identifier. 

De la Huerga discloses a system for linking various types of data records over 
several systems, and further that the system includes URL addresses that include 
application specific context information and chronological (e.g. session) identification 
information transmitted in separate fields of the URL (see column 10, lines 43-59, where 
the context information includes the patient identifier, and the URL also includes 
date/time information; see also Figure 14A). Therefore, it would have been obvious to 
one of ordinary skill in the art at the time the invention was made to further modify the 
system of Cohen and Levergood by including separate URL fields as taught by de la 
Huerga, in order to allow for economical and easy access to information, particularly 
medical records, stored in various distributed databases (see de la Huerga, column 2, 
lines 40-62). 

In reference to Claim 3, Cohen, Levergood, and de la Huerga further disclose 
that the user identification information includes a password (see Cohen, column 4, line 
64-column 5, line 2; see also Levergood column 6, lines 47-49) and the use of a session 
identifier (see Levergood, column 3, lines 12-16, where SID is a session identifier). 
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Additionally, Cohen, Levergood, and de la Huerga disclose that application specific 
context information is a patient identifier (see de la Huerga, column 10, lines 49-52). 

In reference to Claims 4 and 5, Cohen, Levergood, and de la Huerga further 
disclose compiling a database accessible to other applications for mapping a user 
identifier of one application to an already authenticated user identifier of another 
application (see Cohen, column 4, line 61 -column 5, line 6, and column 5, lines 16-22; 
also noting column 5, lines 45-58, where the database can be updated dynamically). 

In reference to Claim 6, Cohen discloses a system including an authentication 
processor that receives and compiles into a database pairs of authentication service 
identifiers and user identifiers (column 4, line 61 -column 5, line 6) and maps a user 
identifier of a second application to an already authenticated user identifier of a first 
application (column 6, lines 26-37). Cohen further discloses a communication 
processor that sends the authenticated user identifier to the second application (column 
6, lines 38-45). However, Cohen does not explicitly disclose automatically 
communicating context information in a data field of a URL to the second application in 
response a user command to initiate execution of the second application. 

Levergood discloses a system that includes an authentication processor (column 
6, lines 36-42) and that, when a user requests execution of a second application, 
automatically communicates specific context information in a data field of a URL to the 
second application (see column 4, lines 1-18) where the context information supports 
acquisition of information associated with a current context (see column 6, lines 22-24). 
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Therefore, it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify the system of Cohen by including the automatic 
communication described by Levergood, in order to allow access to all controlled files 
within a specific domain without requiring additional authorization beyond the initial 
authorization (see Levergood, column 3, lines 50-55). However, although Levergood 
discloses a session identifier (column 3, lines 12-16), neither Levergood nor Cohen 
explicitly discloses that the application specific context information is communicated 
separately from a session identifier. 

De la Huerga discloses a system for linking various types of data records over 
several systems, and further that the system includes URL addresses that include 
application specific context information and session identification information 
transmitted in separate fields of the URL (see column 10, lines 43-59, where the context 
information includes the patient identifier, and the URL also includes date/time/report 
designation information indicative of a particular session; see also Figure 14A). 
Therefore, it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to further modify the system of Cohen and Levergood by including 
separate URL fields as taught by de la Huerga, in order to allow for economical and 
easy access to information, particularly medical records, stored in various distributed 
databases (see de la Huerga, column 2, lines 40-62). 

In reference to Claim 7, Cohen, Levergood, and de la Huerga further disclose 
identifying an authentication service that provides an authenticated user identifier (see 
Cohen, column 4, lines 48-50). 
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In reference to Claim 8, Cohen, Levergood, and de la Huerga further disclose 
matching the authentication service identifier of the second application with the 
authentication service identifier of the first application (see Cohen, column 6, lines 26- 
37). 

In reference to Claim 9, Cohen, Levergood, and de la Huerga further disclose the 
use of a session identifier (see Levergood, column 3, lines 12-16, where SID is a 
session identifier) and that a URL address portion is encrypted and incorporated into the 
URL (see Levergood, column 5, lines 61-65; column 3, lines 34-37, noting that the SID 
includes a domain that is included under the digital signature). Cohen, Levergood, and 
de la Huerga additionally disclose that a key allowing for decryption is accessible to 
multiple applications (see Levergood, column 5, lines 61-65, where the key is shared by 
the authentication and content servers). 

In reference to Claim 10, Cohen, Levergood, and de la Huerga further disclose 
that the authenticated user identifier of the first application is used by the second 
application (see Cohen, column 6, lines 38-45), thus eliminating the need for the second 
application to authenticate the user (Cohen, column 2, lines 28-31). 

In reference to Claim 1 1 , Cohen, Levergood, and de la Huerga further disclose 
sending a parameter identifying success or failure of the mapping (see Cohen, column 
10, lines 35-37, where the return codes indicate success or failure of an operation). 

In reference to Claim 12, Cohen, Levergood, and de la Huerga further disclose 
that the authentication processor receives an authentication service identifier and user 
identifier from the first application (see Cohen, column 6, lines 13-29). 
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In reference to Claim 13, Cohen, Levergood, and de la Huerga further disclose 
that the authentication service identifier employs a predetermined data format (see 
Cohen, column 5, lines 30-44, and column 5, line 63-column 6, line 7). 

In reference to Claim 14, Cohen discloses a system including an authentication 
processor that receives an authentication service identifier and a user identifier from a 
parent application (column 4, line 61 -column 5, line 6) and maps a user identifier of a 
child application to an already authenticated user identifier of the parent application 
(column 6, lines 26-37). Cohen further discloses a communication processor that 
communicates the authenticated user identifier to the child application (column 6, lines 
38-45). However, Cohen does not explicitly disclose automatically communicating 
context information in a data field of a URL to the child application in response a user 
command to initiate execution of the child application. 

Levergood discloses a system that includes an authentication processor (column 
6, lines 36-42) and that, when a user requests execution of a second (child) application, 
automatically communicates specific context information in a data field of a URL to the 
second application (see column 4, lines 1-18) in response to authentication of a user 
identifier (see column 6, lines 58-66, and column 7, lines 15-21) where the context 
information supports acquisition of information associated with a current context (see 
column 6, lines 22-24). Therefore, it would have been obvious to one of ordinary skill in 
the art at the time the invention was made to modify the system of Cohen by including 
the automatic communication described by Levergood, in order to allow access to all 
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controlled files within a specific domain without requiring additional authorization beyond 
the initial authorization (see Levergood, column 3, lines 50-55). However, although 
Levergood discloses a session identifier (column 3, lines 12-16), neither Levergood nor 
Cohen explicitly discloses that the application specific context information is 
communicated separately from a session identifier. 

De la Huerga discloses a system for linking various types of data records over 
several systems, and further that the system includes URL addresses that include 
application specific context information and session identification information 
transmitted in separate fields of the URL (see column 10, lines 43-59, where the context 
information includes the patient identifier, and the URL also includes date/time/report 
designation information indicative of a particular session; see also Figure 14A). 
Therefore, it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to further modify the system of Cohen and Levergood by including 
separate URL fields as taught by de la Huerga, in order to allow for economical and 
easy access to information, particularly medical records, stored in various distributed 
databases (see de la Huerga, column 2, lines 40-62). 

In reference to Claim 1 5, Cohen, Levergood, and de la Huerga further disclose 
that the parent application begins a session and the child application uses the 
authentication system to join the session (see Cohen, column 6, lines 38-45; see also 
Levergood, noting column 3, lines 12-16, where a session is identified by SID). 

In reference to Claim 16, Cohen, Levergood, and de la Huerga further disclose 
that the authentication processor compiles a database using pairs of authentication 
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service identifiers and corresponding user identifiers (see Cohen, column 4, line 61- 
column 5, line 6) and uses the database in mapping the user identifier of the child 
application to the already authenticated user identifier of the parent application (Cohen, 
column 6, lines 26-37). 

In reference to Claim 17, Cohen, Levergood, and de la Huerga further disclose 
matching the authentication service identifier of the child application with the 
authentication service identifier of the parent application (see Cohen, column 6, lines 
26-37). 

In reference to Claim 18, Cohen, Levergood, and de la Huerga further disclose 
identifying an authentication service that provides an authenticated user identifier (see 
Cohen, column 4, lines 48-50). 

In reference to Claim 19, Cohen, Levergood, and de la Huerga further disclose 
that the authenticated user identifier of the parent application is used by the child 
application (see Cohen, column 6, lines 38-45), thus eliminating the need for the child 
application to authenticate the user (Cohen, column 2, lines 28-31). Additionally, 
Cohen, Levergood, and de la Huerga disclose that application specific context 
information is a patient identifier (see de la Huerga, column 10, lines 49-52). 

In reference to Claim 20, Cohen, Levergood, and de la Huerga further disclose 
that the child application enables access in response to receiving the authenticated user 
identifier without the user re-entering the user identification information (see Cohen, 
column 2, lines 28-31, and column 6, lines 38-45). 
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Claims 21 and 22 are method claims that correspond substantially to the systems 
of claims 14 and 16 respectively, and are rejected by a similar rationale. 

Claim 23 is a method claim that corresponds substantially to the system of claim 
1, and is accordingly rejected by a similar rationale. 

Conclusion 

8. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Zachary A. Davis whose telephone number is (571 ) 272- 
3870. The examiner can normally be reached on weekdays 8:30-6:00, alternate 
Fridays off. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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